URL: https://github.com/freeipa/freeipa/pull/920
Author: tduehr
Title: #920: fix ods-ksmutil for 2.0.x
Action: opened
PR body:
"""
It became ods-enforcer and its behavior changed.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/920/head:pr920
git checkout pr920
URL: https://github.com/freeipa/freeipa/pull/953
Author: pvomacka
Title: #953: [master] WebUI: Turn on pagination on certificate page
Action: opened
PR body:
"""
Almost all other search tables use pagination. Only this one does not.
This change makes WebUI more consistent.
https://pagure.io/freeipa/issue/6079
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/953/head:pr953
git checkout pr953
URL: https://github.com/freeipa/freeipa/pull/1024
Author: stlaz
Title: #1024: py3: turn all shebangs to python3
Action: opened
PR body:
"""
This patchset turns all shebangs in IPA scripts to Python 3. Note that this may seem like going against what we agreed on some two months ago but the outcome to turn everything to `/usr/bin/python` to use default python version would be a setback in the Fedora planning: https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 and there is no reason not to use the up-till-now long running Python 3 effort.
This also required to regenerate the `API.txt` file so that our checks don't fail to validate for python2/3 type discrepancies.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1024/head:pr1024
git checkout pr1024
URL: https://github.com/freeipa/freeipa/pull/973
Author: tomaskrizek
Title: #973: test_dnssec: re-add named-pkcs11 workarounds
Action: opened
PR body:
"""
DNSSEC tests starrted to fail again, probably due to a bug in
some underlaying component.
This reverts commit 8bc677512296a7e94c29edd0c1a96aa7273f352a
and makes the xfail test check less strict - it will no longer
mark the test suite red if it passes.
Related https://pagure.io/freeipa/issue/5348
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/973/head:pr973
git checkout pr973
URL: https://github.com/freeipa/freeipa/pull/927
Author: pvomacka
Title: #927: WebUI: Cockpit integration
Action: opened
PR body:
"""
Link to the cockpit is placed to each host details page in case
the Cockpit is installed on the server.
Showing or hiding cockpit link is possible because of Cockpit's API
which provides public URL for check whether Cockpit is the software
which listen on given port.
https://pagure.io/freeipa/issue/4891
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/927/head:pr927
git checkout pr927
URL: https://github.com/freeipa/freeipa/pull/837
Author: frasertweedale
Title: #837: ca-add: fix permission issue
Action: opened
PR body:
"""
The ca-add command pre_callback uses ldap.can_add() to check whether
the user has permission to add CAs. Alas, the GetEffectiveRights
control used by ldap.can_add() doesn't correctly interpret ACIs with
'targetfilter' constraints, and returns a false-negative for
non-admin users, even when they have the 'System: Add CA'
permission.
To work around this, add the CA object to FreeIPA before attempting
to create the CA in Dogtag. If the CA creation in Dogtag succeds,
the user then updates the FreeIPA object with the Authority ID and
other authoritative data returned by Dogtag. If the CA creation in
Dogtag fails, the user cleans up by deleting the newly-created CA
object from FreeIPA.
This modified procedure ensures that the user certainly has the
'System: Add CA' permission before the CA creation in Dogtag is
attempted. But it also means that the user must have 'write' and
'delete' permission on 'ipaca' objects in FreeIPA, so that it can
complete the object after CA creation in Dogtag, or clean up if that
step fails. Therefore, update the 'System: Add CA' permission to
confer 'write' and 'delete' access on 'ipaca' objects, as well as
'add' access.
Fixes: https://pagure.io/freeipa/issue/6609
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/837/head:pr837
git checkout pr837
URL: https://github.com/freeipa/freeipa/pull/1116
Author: rcritten
Title: #1116: Enable ephemeral KRA requests
Action: opened
PR body:
"""
Enabling ephemeral KRA requests will reduce the amount of LDAP
write operations and improve overall performance.
https://pagure.io/freeipa/issue/6703
NOTE: I'm not 100% sure on the upgrade for existing instances. My logic is that tomcat is always stopped and then within that block the CA (if any) will be updated. Given that the KRA runs in the same service that is why I stuck that update code there. It worked in my testing.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1116/head:pr1116
git checkout pr1116
URL: https://github.com/freeipa/freeipa/pull/1011
Author: tomaskrizek
Title: #1011: py3: dnssec
Action: opened
PR body:
"""
This PR is a partial fix that should allow DNSSEC installation for master. Keys will not be distributed to replicas. With my limited DNSSEC/IPA knowledge, I wasn't able to verify the data stored in LDAP are actually correct. In case they are not, this would prevent installation of DNSSEC replicas in the future.
Our DNSSEC tests are not passing, thus we can't use them to verify this PR. Given these circumstances, I propose to officially discourage DNSSEC installation in 4.6.0.
This PR supersedes #898. For review, it is highly recommended to rebase on #999.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1011/head:pr1011
git checkout pr1011
URL: https://github.com/freeipa/freeipa/pull/1047
Author: rcritten
Title: #1047: Use the user-provided CA chain file in connections & check for file existence
Action: opened
PR body:
"""
The user now may provide their own CA chain to the make API commands but it isn't honored.
The value is also not checked for existence throwing a generic "no such file" error rather than "file <foo> doesn't exist"
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1047/head:pr1047
git checkout pr1047
URL: https://github.com/freeipa/freeipa/pull/1056
Author: stlaz
Title: #1056: Remove temporary workaround for Travis CI
Action: opened
PR body:
"""
Once Travis fixes their issue/will post resolution, we can remove the workaround.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1056/head:pr1056
git checkout pr1056
Hello all,
I would like to start a discussion regarding the migration of current
FreeIPA services that are running on OpenShift v2 that was obsoleted [1]
and will go soon EOL (the ultimate cut-off date is Dec 31, 2017).
After a short discussion I had with several FreeIPA developers, the
preference remained with keeping this application on OpenShift (v3
generation), as it will let us easily maintain it on a PaaS, without
having to care about maintaining our own infra. It will be also easy to
delegate maintenance powers to more people.
Given above, I have now set up a Pro account with OpenShift v3 and
migrated the base FreeIPA wiki as an application there, with today
snapshot of data and images. When the POC deployment is ready and
approved on this list, I can switch the current wiki to readonly and
request change of "www.freeipa.org" DNS records to get it to production.
The POC wiki is running in [2], with OpenShift application sources being
stored in a public git repo [3]. Eventually, the OpenShift could be
configured to rebuild the wiki after a git push to [3], to enable easy
changes to wiki to it's maintainers. Let me know if there are any
concerns about having the wiki sources public. The secrets and keys are
of course not in the repo, but configured via OpenShift environment
variable.
The POC now runs pretty well, the only issue I found so far is linking
the wiki user authentication with Fedora auth. The problem is that the
current OpenID plugin [4] is deprecated and does not run with modern PHP
version and I could not get the new OpenID Connect one [5] to work
reliably with our wiki and Fedora OIDC service. I either received
authentication errors or later problems with linking the authenticated
user to current account. So for now I gave up and enabled simple
password auth by password again.
Feedback welcome!
Thanks,
Martin
[1] https://blog.openshift.com/migrate-to-v3-v2-eol/
[2] https://freeipa-org-wiki-freeipa.b9ad.pro-us-east-1.openshiftapps.com
[3] https://github.com/freeipa/freeipa-wiki
[4] https://www.mediawiki.org/wiki/Extension:OpenID
[5] https://www.mediawiki.org/wiki/Extension:OpenID_Connect
--
Martin Kosek <mkosek(a)redhat.com>
Manager, Software Engineering - Identity Management Team
Red Hat, Inc.
URL: https://github.com/freeipa/freeipa/pull/903
Author: felipevolpone
Title: #903: Warning the user when using a loopback IP as forwarder
Action: opened
PR body:
"""
Now, the user can pass a loopback IP in the --forwarder option.
Previously, an error would be raised, now we just show a warning message.
Fixes: https://pagure.io/freeipa/issue/5801
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/903/head:pr903
git checkout pr903
URL: https://github.com/freeipa/freeipa/pull/1027
Author: tomaskrizek
Title: #1027: prci: add external_ca test
Action: opened
PR body:
"""
Add external_ca to the PR CI test suite.
Signed-off-by: Tomas Krizek <tkrizek(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1027/head:pr1027
git checkout pr1027
URL: https://github.com/freeipa/freeipa/pull/1114
Author: rcritten
Title: #1114: Use 389-ds provided method for file limits tuning
Action: opened
PR body:
"""
Previously IPA would set the LimitNOFILE value to 8192 to increase
the number of concurrent clients. 389-ds-base does this by default
as of 1.3.7.0.
Remove the IPA-specific tuning and rely on the out-of-the-box
389-ds-base tuning.
Bump the required version of 389-ds-base to 1.3.7.0.
Any other tuning added by 389-ds-base will result in a
dirsrv.systemd.rpmsave file which admins will need to merge
in manually, like typical .rpmsave config changes.
https://pagure.io/freeipa/issue/6994
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1114/head:pr1114
git checkout pr1114
URL: https://github.com/freeipa/freeipa/pull/1033
Author: felipevolpone
Title: #1033: Fixing internal error in param-{find,show}
Action: opened
PR body:
"""
Fixing internal error in param-{find,show} with nonexistent object and showing properly error message.
Since PR #1013 probably won't be updated anymore, I created this one with previous work plus some additional changes.
https://pagure.io/freeipa/issue/7134
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1033/head:pr1033
git checkout pr1033
URL: https://github.com/freeipa/freeipa/pull/1079
Author: flo-renaud
Title: #1079: ipa-server-upgrade: fix the logic for tracking certs
Action: opened
PR body:
"""
ipa-server-upgrade needs to configure certmonger with the right options
in order to track PKI, HTTP and LDAP certs (for instance the RA agent cert
location has changed from older releases).
The upgrade code looks for existing tracking requests with the expected
options by using criteria (location of the NSSDB, nickname, CA helper...)
If a tracking request is not found, it means that it is either using wrong
options or not configured. In this case, the upgrade stop tracking
all the certs, reconfigures the helpers, starts tracking the certs so that
the config is up-to-date.
The issue is that the criteria is using the keyword 'ca' instead of
'ca-name' and this leads to upgrade believing that the config needs to be
updated in all the cases.
https://pagure.io/freeipa/issue/7151
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1079/head:pr1079
git checkout pr1079
URL: https://github.com/freeipa/freeipa/pull/1115
Author: sumit-bose
Title: #1115: ipa-kdb: reinit trusted domain data for enterprise principals
Action: opened
PR body:
"""
While processing enterprise principals the information about trusted domains
might not be up-to-date. With this patch ipadb_reinit_mspac() is called if an
unknown domain is part of the enterprise principal.
Resolves https://pagure.io/freeipa/issue/7172
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1115/head:pr1115
git checkout pr1115
URL: https://github.com/freeipa/freeipa/pull/1106
Author: Rezney
Title: #1106: tests: add host zone with overlap
Action: opened
PR body:
"""
This patch is mainly for test_forced_client_reenrolment suite
where when we are not in control of our client DNS we create an
overlap zone in order to get the host records updated. This also
sets resolv.conf before every ipa-client-install to the ipa master.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1106/head:pr1106
git checkout pr1106
URL: https://github.com/freeipa/freeipa/pull/1118
Author: Rezney
Title: #1118: tests_py3: decode get_file_contents() result
Action: opened
PR body:
"""
When running tests in python3 we get bytes object instead of
bytestring and when passing it to multihost run_command we later
fail on concatenation in shell_quote().
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1118/head:pr1118
git checkout pr1118
URL: https://github.com/freeipa/freeipa/pull/1109
Author: rcritten
Title: #1109: Collect group membership without a size limit
Action: opened
PR body:
"""
If the # of group memberships exceeded the search size limit
then SizeLimitExceeded was raised. Being in too many groups
should not cause a *_show to fail.
https://pagure.io/freeipa/issue/7112
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1109/head:pr1109
git checkout pr1109
URL: https://github.com/freeipa/freeipa/pull/930
Author: frasertweedale
Title: #930: install: allow specifying external CA template
Action: opened
PR body:
"""
This PR allow an admin to specify an AD-CS target certificate template
by name or OID, via the new option --external-ca-profile.
The profile may be specified by name (string) or OID + version + optional minor version.
https://pagure.io/freeipa/issue/6858
The approach is:
1. preliminary refactor to the IPAOptionParser to allow easily specifying a custom
data constructor (this is used for the data type that holds the template specifier).
2. refactor to reduce duplication of external CA type enum values.
3. the main thing:
- add data type for template specifier
- add ipa-server-install `--external-ca-profile` CLI option
- update CA installation to add the appropriate *pkispawn* config based on the template
specifier
- update *ipa-server-install* man page
4. add the `external-ca-profile` option to *ipa-ca-install* and update man page.
**NOTE FOR TESTERS**
*python-cryptography* has a bug parsing long OIDs. It is fixed as of v1.9 (f27).
AD-CS creates and uses OIDs long enough to trigger the bug as a matter of course.
Apply the following small diff to your *python-cryptography* lib to avoid the bug:
https://github.com/frasertweedale/cryptography/blob/effeb600057a93f7cb95df1…
**HOW TO TEST**
1. Install AD-CS in a Windows machine and create a custom profile by copying the *SubCA*
profile.
2. Two-step external CA ipa-server-install:
```
$ ipa-server-install \
--external-ca --external-ca-type=ms-cs \
--external-ca-profile=1.3.6.1.4.1.311.21.8.8950086.10656446.2706058.12775672.480128.147.7130143.4405632:1
```
(Use the actual OID of the custom profile). If everything works, hooray!
3. Start over with ca-less deployment. Then add CA via ``ipa-ca-install --external-ca-... # as before``.
If everything works, hooray.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/930/head:pr930
git checkout pr930
URL: https://github.com/freeipa/freeipa/pull/1113
Author: stlaz
Title: #1113: [Backport][ipa-4-6] test_external_ca: switch to python-cryptography
Action: opened
PR body:
"""
This PR was opened automatically because PR #1053 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1113/head:pr1113
git checkout pr1113
URL: https://github.com/freeipa/freeipa/pull/1107
Author: tomaskrizek
Title: #1107: [Backport][ipa-4-6] py3: fix pkcs7 file processing
Action: opened
PR body:
"""
This PR was opened automatically because PR #1102 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1107/head:pr1107
git checkout pr1107
URL: https://github.com/freeipa/freeipa/pull/894
Author: felipevolpone
Title: #894: Fixing ipa-replica-install --setup-kra if it's the first KRA in topology
Action: opened
PR body:
"""
I'm trying to fix the ticket, but I'm not quite sure of how to do it. Until now, I removed the exception and called the api in kra to install it. However, I'm getting an exception:
```
bash-4.3$ sudo python /usr/sbin/ipa-replica-install -r DOM-116.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM --setup-kra --setup-ca
WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd
IPA client is already configured on this system, ignoring the --domain, --server, --realm, --hostname, --password and --keytab options.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Timed out trying to obtain keys.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
```
from /var/log/ipareplica-install.log
```
2017-06-23T18:38:44Z DEBUG stderr=
2017-06-23T18:38:44Z DEBUG Destroyed connection context.ldap2_140135237350736
2017-06-23T18:38:44Z DEBUG Created connection context.ldap2_140135237350736
2017-06-23T18:38:44Z DEBUG raw: hostgroup_show(u'ipaservers', rights=True, all=True, version=u'2.228')
2017-06-23T18:38:44Z DEBUG hostgroup_show(u'ipaservers', rights=True, all=True, raw=False, version=u'2.228', no_members=False)
2017-06-23T18:38:44Z DEBUG flushing ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com from SchemaCache
2017-06-23T18:38:44Z DEBUG retrieving schema for SchemaCache url=ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f73c6769f38>
2017-06-23T18:38:44Z DEBUG Destroyed connection context.ldap2_140135237350736
2017-06-23T18:38:44Z DEBUG Created connection context.ldap2_140135237350736
2017-06-23T18:38:44Z DEBUG flushing ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com from SchemaCache
2017-06-23T18:38:44Z DEBUG retrieving schema for SchemaCache url=ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f73c6769c20>
2017-06-23T18:38:44Z DEBUG No IPA DNS servers, skipping forward/reverse resolution check
2017-06-23T18:38:44Z DEBUG Initializing principal host/vm-058-064.abc.idm.lab.eng.brq.redhat.com(a)DOM-116.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM using keytab /etc/krb5.keytab
2017-06-23T18:38:44Z DEBUG using ccache /tmp/krbcc9omA2g/ccache
2017-06-23T18:38:44Z DEBUG Attempt 1/1: success
2017-06-23T18:38:44Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-06-23T18:38:44Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2017-06-23T18:38:44Z INFO Waiting up to 300 seconds to see our keys appear on host: None
2017-06-23T18:38:45Z DEBUG Transient error getting keys: '{'desc': "Can't contact LDAP server"}'
2017-06-23T18:43:45Z DEBUG Destroyed connection context.ldap2_140135237350736
2017-06-23T18:43:45Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 366, in run
self.validate()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 375, in validate
for _nothing in self._validator():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure
next(validator)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 613, in main
replica_promote_check(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 386, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 408, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1270, in promote_check
raise ScriptError(e)
2017-06-23T18:43:45Z DEBUG The ipa-replica-install command failed, exception: ScriptError: Timed out trying to obtain keys.
2017-06-23T18:43:45Z ERROR Timed out trying to obtain keys.
2017-06-23T18:43:45Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
```
There is a high chance that I'm getting the wrong path here, so if there is someone able to help me (pointing to some docs or explaining more details of it), it would be great.
Ticket https://pagure.io/freeipa/issue/7008
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/894/head:pr894
git checkout pr894
URL: https://github.com/freeipa/freeipa/pull/937
Author: felipevolpone
Title: #937: Configuring log handlers during the input parameters validation phase
Action: opened
PR body:
"""
Previously, a log handler would be configured only after all the input parameters be validated, as can be checked in `ipapython/admintool.py::AdminTool::main`. So, any call to `logger.[warning,info,error,debug]`, during that phase, doesn't work and it also raises an exception.
Now, log handlers are setup before the input parameters validation phase.
Fixes: https://pagure.io/freeipa/issue/7071
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/937/head:pr937
git checkout pr937
URL: https://github.com/freeipa/freeipa/pull/1053
Author: Rezney
Title: #1053: test_external_ca: switch to python-cryptography
Action: opened
PR body:
"""
Switch external CA generation from certutil to python-cryptography
as this way of handling the certificates should be more readable,
maintainable and extendable (e.g. extensions handling).
Also as external CA is now a separate module we can import it and
use elsewhere.
E.g. add ca-less to ca-external-full...
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1053/head:pr1053
git checkout pr1053
TL;DR Should ipaplatform be dynamic or fixed at build time?
Last November a ticket was proposed to change the platform detection
from being done at build time (via autoconf) to runtime in ticket
https://pagure.io/freeipa/issue/6474
This was inspired somewhat by
http://www.freeipa.org/page/V4/Integration_Improvements
This consisted of two main proposals:
1. Let one specify the location of the IPA configuration so that clients
not enrolled via ipa-client-install can still work (e.g. you can use it
completely as non-root).
2. Make ipaplatform dynamically detect the underlying OS for use in PyPi.
Discussion on this proposal happened in thread
https://www.redhat.com/archives/freeipa-devel/2016-November/msg00391.html
Discussion continued in the PR,
https://www.redhat.com/archives/freeipa-devel/2016-November/msg00887.html
From my reading no firm decision (beyond pushing the code) was made
except that there was resistance to both of these proposals. The
relevant part for now is ipaplatform. Moving around a bunch of code
ended up being quite disruptive internally and wasn't ultimately
completely successful, see https://github.com/freeipa/freeipa/pull/1036
The boat has sailed on moving the code around but the moves were
disruptive to anything that was using ipalib (another discussion
altogether is the supportabilty/stability of ipalib).
What we're left with is that the PyPi build is currently broken and has
been for several weeks. The current proposed fix is to duplicate values
which while undesirable generally is a quick and dirty way to get PyPi
working. Felipe agreed to update his PR to use a _ prefix to indicate
the constants are for internal-use only. This should buy us time to work
on a more complete solution.
So to me the question is dynamic vs build-time detection of the
underlying OS. If one lives in the world of only OS-distributed packages
then build-time detection makes perfect sense and leaves no room for
error on deployed systems.
PyPi is another story though. The PyPi version doesn't ship ipaplatform
at all which makes PyPi a bit of a second-class citizen. This could
impact future systems like ansible that might want to deploy from PyPi,
and tox which often installs its own dependencies during testing. PyPi
also lets one easily install different versions of packages in different
virtual environments for expanded testing without requiring root.
IMHO something needs to change. Felipe's PR has the feeling of the first
of a thousand cuts. I'm in favor of runtime detection with extreme, if
not ridiculous logging. The major downside of runtime detection, which
wasn't discussed previously, is opaqueness: you can't tell why things
are behaving as they are because the runtime choice was opaque. With
copious debug-level logging I think this would be a moot point. Bugs may
still occur with detection but they will hopefully be painfully obvious
and easily fixable.
The main opposition to runtime dependency seemed to me to be related to
handling failures gracefully. I think a hard stop with tons of output is
sufficient to handle this case. All major distros already do a lot of
testing pre-release which would catch any issues. There remains some
risk for bleeding-edge releases that could make changes post-release.
If /etc/os-release goes away then this would have to be dealt with in
the installer anyway, the impact will just be broader (and therefore
likely fixed faster).
It may be worthwhile to collect /etc/os-release from as many Linux
distros as possible to ensure the best level of compatibility.
A final else "Your distro is not supported" will handle things we have
not encountered yet, or targeted (e.g. win32, Solaris, etc). Support for
these could be contributed.
rob
Good morning,
My name is Brian Gribble and I am a Consultant at Red Hat. I would like to
contribute to the FreeIPA project by testing and helping with documentation
(wiki edits, etc). The testing part is self-explanatory but I would like
to know what I need to do to help with wiki edits.
I am following the guidelines from the "Contribute" wiki page. I hope it's
up to date.
My IRC nick is brian83.
Thanks,
Brian
--
Brian Gribble
Platform Consultant
Red Hat Consulting <https://www.redhat.com>
bgribble(a)redhat.com
<https://red.ht/sig>
URL: https://github.com/freeipa/freeipa/pull/1111
Author: stlaz
Title: #1111: ipalib.x509 autumn cleanup
Action: opened
PR body:
"""
This is a cleanup of the x509 module which removes an ugly hack that prevents a circular dependency and the `strip_header()` function which is properly replaced by the `load_unknown_x509_certificate()` function where needed.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1111/head:pr1111
git checkout pr1111
URL: https://github.com/freeipa/freeipa/pull/1110
Author: stlaz
Title: #1110: csrgen: Introduce CertificateSigningRequest parameter
Action: opened
PR body:
"""
This pull request tries to introduce a new parameter for CSRs so that these are handled properly in Python 3 and are backward-compatible with the older API which will try to send strings to the server.
**NOTE**: tests for the new parameter are currently not included, it's here for the sole purpose of a review of the code and should not be pushed until the tests arrive.
- [x] do the code
- [ ] do the tests
-----------------------
This PR includes code @flo-renaud's fix from https://github.com/freeipa/freeipa/pull/1057
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1110/head:pr1110
git checkout pr1110
The FreeIPA team would like to announce FreeIPA 4.6.1 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora 26 and 27 are available in the official @freeipa/freeipa-4-6 COPR
repository [1].
== Highlights in 4.6.1 ==
=== Known Issues ===
* PyPI packages are broken since 4.6.0 #7132
=== Bug fixes ===
FreeIPA 4.6.1 is a stabilization release for the features delivered as a
part of 4.6.0.
There are more than 10 bug-fixes details of which can be seen in
the list of resolved tickets below.
== Upgrading ==
Upgrade instructions are available on Upgrade page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users
mailing
list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 7157 [tracker] pyasn1 fails to parse kerberos principal name
* 7150 Ipa-server-install update dse.ldif with wrong SELinux context
* 7143 "unknown command 'undefined'" error when changing user's password
via the web UI
* 7135 Server deployment still sets up Firefox extension, this is no
longer necessary and broken on F27+
* 7129 ipa-server/replica-install fails with: "exception: BytesWarning:
Comparison between bytes and string" when using '--dirsrv-config-file'
parameter
* 7119 kdc_proxy: kinit admin fails with "Cannot contact any KDC for
realm 'IPA.TEST' while getting initial credentials"
* 7115 ipa-pki-retrieve-key: failure results in crash report
* 7081 [ipatests] - installutils.is_ipa_configured() - users other then
root cannot check if IPA is configured
* 7027 Use TLS for cert-find
* 6874 pylint 1.7.1 fails
* 6848 Test IPA with OpenSSL-base libcurl for Fedora 27
* 6566 [py3] session cookie not found with py3
* 5121 [py3] Remove unnecessary calls to dict.keys()
== Detailed changelog since 4.6.0 ==
=== Alexander Bokovoy (3) ===
* Make sure upgrade also checks for IPv6 stack
* OTP import: support hash names with HMAC- prefix
* dsinstance: Restore context after changing dse.ldif
=== Felipe Volpone (2) ===
* Changing idoverrideuser-* to treat objectClass case insensitively
* Fixing how sssd.conf is updated when promoting a client to replica
=== Florence Blanc-Renaud (3) ===
* Fix ipa-server-upgrade with server cert tracking
* Python3: Fix winsync replication agreement
* Fix ipa config-mod --ca-renewal-master
=== Fraser Tweedale (2) ===
* ipa-pki-retrieve-key: ensure we do not crash
* issue_server_cert: avoid application of str to bytes
=== Martin Basti (1) ===
* py3: set samba dependencies
=== Petr Vobornik (1) ===
* browser config: cleanup after removal of Firefox extension
=== Pavel Vomacka (3) ===
* WebUI: Fix calling undefined method during reset passwords
* WebUI: remove unused parameter from get_whoami_command
* Adds whoami DS plugin in case that plugin is missing
=== Rob Crittenden (2) ===
* Add exec to /var/lib/ipa/sysrestore for install status inquiries
* Use TLS for the cert-find operation
=== Stanislav Laznicka (28) ===
* Don't write p11-kit EKU extension object if no EKU
* pylint: fix missing module
* travis: run the same tests in python2/3
* certmap testing: fix wrong cert construction
* ldap2: don't use decode() on str instance
* client: fix retrieving certs from HTTP
* uninstall: remove deprecation warning
* ldif: handle attribute names as strings
* pkinit: fix sorting dictionaries
* pkinit: don't fail when no pkinit servers found
* travis: remove "fast" from "makecache fast"
* Change Travis CI container to FreeIPA-owned
* Change the requirements for pylint in wheel
* rpcserver: don't call xmlserver.Command
* secrets: disable relative-imports for custodia
* pylint: disable __hash__ for some classes
* install.util: disable no-value-for-parameter
* pylint: make unsupported-assignment-operation check local
* sudocmd: fix unsupported assignment
* pylint: Iterate through dictionaries
* parameters: convert Decimal.precision to int
* dcerpc: disable unbalanced-tuple-unpacking
* dcerpc: refactor assess_dcerpc_exception
* pylint: fix no-member in schema plugin
* csrgen: fix incorrect codec for pyasn BitString
* pylint: fix not-context-manager false positives
* Travis: archive logs of py3 jobs
* travis: temporary workaround for Travis CI
=== Tomas Krizek (6) ===
* Become IPA 4.6.1
* Update contributors
* Update translations
* spec: bump python-pyasn1 to 0.3.2-2
* prci: use f26 template for master
* VERSION: set back to git snapshot
[1] - https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
URL: https://github.com/freeipa/freeipa/pull/1104
Author: tomaskrizek
Title: #1104: [Backport][ipa-4-6] browser config: cleanup after removal of Firefox extension
Action: opened
PR body:
"""
This PR was opened automatically because PR #1034 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1104/head:pr1104
git checkout pr1104
URL: https://github.com/freeipa/freeipa/pull/1034
Author: pvoborni
Title: #1034: browser config: cleanup after removal of Firefox extension
Action: opened
PR body:
"""
Firefox extension which served for configuring Kerberos auth in Firefox
until version which banned self-signed extensions was removed in commit
6c53765ac1746ea3cb82554775a37fe43af062e8.
Given that configure.jar, even older Firefox config tool, was removed
sometime before that, there is no use for signtool tool. It is good
because it is removed from Fedora 27 anyway. So removing last unused
function which calls it.
The removal of FF extension was not exactly clean so removing also
browserconfig.html which only purpose was to use the extension. Therefore
also related JS files are removed. This removal requires unauthorized.html
to be updated so that it doesn't point to non-existing page. And given that
it now points only to single config page, we can change link in UI login page
to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html.
Btw, commit 6c53765ac1746ea3cb82554775a37fe43af062e8 removed also generation of
krb.js. It had one perk - with that info ssbrowser.html could display real
Kerberos domain instead of only 'example.com'. I don't have time to revert this
change so removing traces of krb.js as well.
https://pagure.io/freeipa/issue/7135
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1034/head:pr1034
git checkout pr1034
URL: https://github.com/freeipa/freeipa/pull/933
Author: felipevolpone
Title: #933: Checks if Directory Server is installed and running before installation
Action: opened
PR body:
"""
In cases when IPA is installed in two steps (external CA), it's necessary to check (in the second step) if Directory Server is running and if it's installed before continue with the IPA installation.
Fixes: https://pagure.io/freeipa/issue/6611
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/933/head:pr933
git checkout pr933
Just a heads up that running tests on f27 is a bit of a problem
right now, due to a bug in paramiko that gets triggered when
importing pytest_multihost.transport.
Relevant upstream issues:
- https://github.com/paramiko/paramiko/issues/1069
- https://github.com/paramiko/paramiko/pull/861
A quick workaround:
--- /usr/lib/python2.7/site-packages/paramiko/ssh_gss.py.orig
+++ /usr/lib/python2.7/site-packages/paramiko/ssh_gss.py
@@ -52,7 +52,7 @@
try:
import gssapi
GSS_EXCEPTIONS = (gssapi.GSSException,)
-except (ImportError, OSError):
+except (ImportError, OSError, AttributeError):
try:
import pywintypes
import sspicon
Cheers,
Fraser
URL: https://github.com/freeipa/freeipa/pull/1103
Author: tomaskrizek
Title: #1103: ipatests: keep default log level for 389-ds
Action: opened
PR body:
"""
The log level of 8192 for 389-ds is very noisy and conceals useful debug
messages. The default log level 0 should be sufficient for our purposes.
Fixes: https://pagure.io/freeipa/issue/7162
Signed-off-by: Tomas Krizek <tkrizek(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1103/head:pr1103
git checkout pr1103
URL: https://github.com/freeipa/freeipa/pull/1101
Author: tomaskrizek
Title: #1101: [Backport][ipa-4-6] Make sure upgrade also checks for IPv6 stack
Action: opened
PR body:
"""
This PR was opened automatically because PR #1095 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1101/head:pr1101
git checkout pr1101
URL: https://github.com/freeipa/freeipa/pull/1094
Author: stlaz
Title: #1094: [Backport][ipa-4-6] Don't write p11-kit EKU extension object if no EKU
Action: opened
PR body:
"""
This PR was opened automatically because PR #1090 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1094/head:pr1094
git checkout pr1094
URL: https://github.com/freeipa/freeipa/pull/1092
Author: stlaz
Title: #1092: [Backport][ipa-4-6] Fall back to using configuration to determine server config status
Action: opened
PR body:
"""
This PR was opened automatically because PR #1084 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1092/head:pr1092
git checkout pr1092
URL: https://github.com/freeipa/freeipa/pull/1096
Author: tomaskrizek
Title: #1096: [Backport][ipa-4-6] spec: bump python-pyasn1 to 0.3.2-2
Action: opened
PR body:
"""
This PR was opened automatically because PR #1091 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1096/head:pr1096
git checkout pr1096
URL: https://github.com/freeipa/freeipa/pull/1100
Author: tomaskrizek
Title: #1100: [Backport][ipa-4-5] Make sure upgrade also checks for IPv6 stack
Action: opened
PR body:
"""
Opening the ipa-4-5 backport manually so it can pass through CI quicker. Original PR: #1095
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1100/head:pr1100
git checkout pr1100
URL: https://github.com/freeipa/freeipa/pull/1095
Author: abbra
Title: #1095: Make sure upgrade also checks for IPv6 stack
Action: opened
PR body:
"""
- Add check for IPv6 stack to upgrade process
- Change IPv6 checker to also check that localhost resolves to ::1
Part of fixes https://pagure.io/freeipa/issue/7083
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1095/head:pr1095
git checkout pr1095
URL: https://github.com/freeipa/freeipa/pull/1093
Author: stlaz
Title: #1093: [Backport][ipa-4-6] Fix ipa-server-upgrade with server cert tracking
Action: opened
PR body:
"""
This PR was opened automatically because PR #1045 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1093/head:pr1093
git checkout pr1093
URL: https://github.com/freeipa/freeipa/pull/1097
Author: flo-renaud
Title: #1097: Backport 4-5: Fix ipa-server-upgrade with server cert tracking
Action: opened
PR body:
"""
ipa-server-upgrade fails with Server-Cert not found, when trying to
track httpd/ldap server certificates. There are 2 issues in the upgrade:
- the certificates should be tracked only if they were issued by IPA CA
(it is possible to have CA configured but 3rd part certs)
- the certificate nickname can be different from Server-Cert
The fix provides methods to find the server crt nickname for http and ldap,
and a method to check if the server certs are issued by IPA and need to be
tracked by certmonger.
https://pagure.io/freeipa/issue/7141
Reviewed-By: Stanislav Laznicka <slaznick(a)redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1097/head:pr1097
git checkout pr1097
URL: https://github.com/freeipa/freeipa/pull/1091
Author: tomaskrizek
Title: #1091: spec: bump python-pyasn1 to 0.3.2-2
Action: opened
PR body:
"""
The new python-pyasn1 fixes an issue that occurred during ca-less
installation.
Fixes: https://pagure.io/freeipa/issue/7157
Signed-off-by: Tomas Krizek <tkrizek(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1091/head:pr1091
git checkout pr1091
URL: https://github.com/freeipa/freeipa/pull/1090
Author: stlaz
Title: #1090: Don't write p11-kit EKU extension object if no EKU
Action: opened
PR body:
"""
b5732efd introduced a regression because it tries to write EKU
that's actually in the CA cert instead of using the LDAP information.
However, when no EKU is available,
IPACertificate.extended_key_usage_bytes still returned at least
EKU_PLACEHOLDER OID to keep the behavior the same as in previous
versions. This caused the EKU_PLACEHOLDER to be written in the
ipa.p11-kit file which made Firefox report FreeIPA Web UI as
improperly configured.
https://pagure.io/freeipa/issue/7119
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1090/head:pr1090
git checkout pr1090
URL: https://github.com/freeipa/freeipa/pull/1045
Author: flo-renaud
Title: #1045: Fix ipa-server-upgrade with server cert tracking
Action: opened
PR body:
"""
ipa-server-upgrade fails with Server-Cert not found, when trying to
track httpd/ldap server certificates. There are 2 issues in the upgrade:
- the certificates should be tracked only if they were issued by IPA CA or
IPA lighweight subCA (it is possible to have CA configured but 3rd part certs)
- the certificate nickname can be different from Server-Cert
The fix provides methods to find the server crt nickname for http and ldap,
and a method to check if the server certs are issued by IPA and need to be
tracked by certmonger.
https://pagure.io/freeipa/issue/7141
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1045/head:pr1045
git checkout pr1045
URL: https://github.com/freeipa/freeipa/pull/1089
Author: stlaz
Title: #1089: [Backport][ipa-4-6] Use TLS for the cert-find operation
Action: opened
PR body:
"""
This PR was opened automatically because PR #1042 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1089/head:pr1089
git checkout pr1089
URL: https://github.com/freeipa/freeipa/pull/1084
Author: rcritten
Title: #1084: Fall back to using configuration to determine server config status
Action: opened
PR body:
"""
The original method for determining whether IPA was configured or
not depended on being able to read the sysrestore files which are
only readable by root.
Add a fallback that uses the IPA config to determine the status.
The ldap_uri should only be set on servers and as an extra check
look for an ldapi uri.
https://pagure.io/freeipa/issue/7157
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1084/head:pr1084
git checkout pr1084
URL: https://github.com/freeipa/freeipa/pull/1087
Author: stlaz
Title: #1087: [Backport][ipa-4-5] OTP import: support hash names with HMAC- prefix
Action: opened
PR body:
"""
This PR was opened automatically because PR #1081 was pushed to master and backport to ipa-4-5 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1087/head:pr1087
git checkout pr1087
URL: https://github.com/freeipa/freeipa/pull/1086
Author: stlaz
Title: #1086: [Backport][ipa-4-6] OTP import: support hash names with HMAC- prefix
Action: opened
PR body:
"""
This PR was opened automatically because PR #1081 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1086/head:pr1086
git checkout pr1086
URL: https://github.com/freeipa/freeipa/pull/1088
Author: stlaz
Title: #1088: [Backport][ipa-4-6] pylint: fix missing module on F27+
Action: opened
PR body:
"""
This PR was opened automatically because PR #1085 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1088/head:pr1088
git checkout pr1088
URL: https://github.com/freeipa/freeipa/pull/1085
Author: stlaz
Title: #1085: pylint: fix missing module on F27+
Action: opened
PR body:
"""
`requests.packages` contains but a weird backward compatibility fix
for its presumed `urllib3` submodule but pylint does not approve.
-----------------------
This fixes https://travis-ci.org/stlaz/freeipa/jobs/276586970
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1085/head:pr1085
git checkout pr1085
URL: https://github.com/freeipa/freeipa/pull/1081
Author: abbra
Title: #1081: OTP import: support hash names with HMAC- prefix
Action: opened
PR body:
"""
Refactor convertHashName() method to accept hash names prefixed with
HMAC- or any other prefix. Extending the method should be easier in
future.
Fixes https://pagure.io/freeipa/issue/7146
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1081/head:pr1081
git checkout pr1081
URL: https://github.com/freeipa/freeipa/pull/1082
Author: stlaz
Title: #1082: [Backport][ipa-4-6] Python3: Fix winsync replication agreement
Action: opened
PR body:
"""
This PR was opened automatically because PR #1018 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1082/head:pr1082
git checkout pr1082
URL: https://github.com/freeipa/freeipa/pull/1080
Author: stlaz
Title: #1080: [Backport][ipa-4-6] travis: run the same tests in python2/3
Action: opened
PR body:
"""
This PR was opened automatically because PR #1052 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1080/head:pr1080
git checkout pr1080
URL: https://github.com/freeipa/freeipa/pull/1018
Author: flo-renaud
Title: #1018: Python3: Fix winsync replication agreement
Action: opened
PR body:
"""
When configuring a winsync replication agreement, the tool performs a search
on AD for defaultNamingContext. The entry contains the value as a bytes, it
needs to be decoded otherwise subsequent calls to
DN(WIN_USER_CONTAINER, self.ad_suffix) will fail.
https://pagure.io/freeipa/issue/4985
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1018/head:pr1018
git checkout pr1018
URL: https://github.com/freeipa/freeipa/pull/1052
Author: stlaz
Title: #1052: travis: run the same tests in python2/3
Action: opened
PR body:
"""
We missed running some tests in python3
https://pagure.io/freeipa/issue/7131
------------
When meddling with the Travis CI settings, I noticed that we still don't run all the tests in both Python versions. I wish I noticed earlier.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1052/head:pr1052
git checkout pr1052
URL: https://github.com/freeipa/freeipa/pull/1061
Author: stlaz
Title: #1061: prci: use f26 template for master
Action: opened
PR body:
"""
Switch PR CI testing of master branch to Fedora 26.
Signed-off-by: Tomas Krizek <tkrizek(a)redhat.com>
---------------------
I hardly doubt the templates will be there, if they are not, @felipevolpone should take care of that.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1061/head:pr1061
git checkout pr1061
URL: https://github.com/freeipa/freeipa/pull/1073
Author: felipevolpone
Title: #1073: Testing a new vagrant box for PR CI using f26 to ipa-4-5
Action: opened
PR body:
"""
Using PR CI triggers to test if the new vagrant box will work properly.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1073/head:pr1073
git checkout pr1073
URL: https://github.com/freeipa/freeipa/pull/1076
Author: felipevolpone
Title: #1076: [backport][ipa-4-5] Changing idoverrideuser-* to treat objectClass case insensitively
Action: opened
PR body:
"""
This is import to avoid problems when migrating from olders
versions of IPA and using idoverrideuser-* commands.
https://pagure.io/freeipa/issue/7074
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1076/head:pr1076
git checkout pr1076
URL: https://github.com/freeipa/freeipa/pull/1075
Author: felipevolpone
Title: #1075: [backport][ipa-4-5] Fixing how sssd.conf is updated when promoting a client to replica
Action: opened
PR body:
"""
When promoting a client to a replica we have to change sssd.conf,
deleting _srv_ part from 'ipa_server' property and setting 'ipa_server_mode' to true.
Previously, the wrong domain could be updated since the ipa_domain variable was not being used properly.
https://pagure.io/freeipa/issue/7127
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1075/head:pr1075
git checkout pr1075
URL: https://github.com/freeipa/freeipa/pull/1074
Author: stlaz
Title: #1074: [Backport][ipa-4-6] ipa-pki-retrieve-key: ensure we do not crash
Action: opened
PR body:
"""
This PR was opened automatically because PR #996 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1074/head:pr1074
git checkout pr1074
URL: https://github.com/freeipa/freeipa/pull/996
Author: frasertweedale
Title: #996: ipa-pki-retrieve-key: ensure we do not crash
Action: opened
PR body:
"""
If ipa-pki-retrieve-key fails for some reason (which may be a
"legitimate" reason, e.g. the server it is attempting to contact
being offline), the program terminates with an uncaught exception,
resulting in crash report.
Catch all exceptions; if an exception gets raised, report the
traceback and exit with nonzero status.
Fixes: https://pagure.io/freeipa/issue/7115
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/996/head:pr996
git checkout pr996
URL: https://github.com/freeipa/freeipa/pull/1072
Author: stlaz
Title: #1072: [Backport][ipa-4-6] client: fix retrieving certs from HTTP
Action: opened
PR body:
"""
This PR was opened automatically because PR #1071 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1072/head:pr1072
git checkout pr1072
URL: https://github.com/freeipa/freeipa/pull/1070
Author: stlaz
Title: #1070: [Backport][ipa-4-6] Changing idoverrideuser-* to treat objectClass case insensitively
Action: opened
PR body:
"""
This PR was opened automatically because PR #950 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1070/head:pr1070
git checkout pr1070
URL: https://github.com/freeipa/freeipa/pull/1069
Author: stlaz
Title: #1069: [Backport][ipa-4-6] uninstall: remove deprecation warning
Action: opened
PR body:
"""
This PR was opened automatically because PR #1054 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1069/head:pr1069
git checkout pr1069
URL: https://github.com/freeipa/freeipa/pull/1068
Author: stlaz
Title: #1068: [Backport][ipa-4-6] ldif: handle attribute names as strings
Action: opened
PR body:
"""
This PR was opened automatically because PR #1049 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1068/head:pr1068
git checkout pr1068
URL: https://github.com/freeipa/freeipa/pull/1064
Author: stlaz
Title: #1064: [Backport][ipa-4-6] issue_server_cert: avoid application of str to bytes
Action: opened
PR body:
"""
This PR was opened automatically because PR #1050 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1064/head:pr1064
git checkout pr1064
URL: https://github.com/freeipa/freeipa/pull/1067
Author: stlaz
Title: #1067: [Backport][ipa-4-5] pkinit: don't fail when no pkinit servers found
Action: opened
PR body:
"""
This PR was opened automatically because PR #1046 was pushed to master and backport to ipa-4-5 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1067/head:pr1067
git checkout pr1067
URL: https://github.com/freeipa/freeipa/pull/950
Author: felipevolpone
Title: #950: Changing idoverrideuser-* to treat objectClass case insensitively
Action: opened
PR body:
"""
This is import to avoid problems when migrating from olders
versions of IPA and using idoverrideuser-* commands.
https://pagure.io/freeipa/issue/7074
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/950/head:pr950
git checkout pr950
URL: https://github.com/freeipa/freeipa/pull/1065
Author: stlaz
Title: #1065: [Backport][ipa-4-6] pkinit: fix sorting dicts
Action: opened
PR body:
"""
This PR was opened automatically because PR #1029 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1065/head:pr1065
git checkout pr1065
URL: https://github.com/freeipa/freeipa/pull/1066
Author: stlaz
Title: #1066: [Backport][ipa-4-6] pkinit: don't fail when no pkinit servers found
Action: opened
PR body:
"""
This PR was opened automatically because PR #1046 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1066/head:pr1066
git checkout pr1066
URL: https://github.com/freeipa/freeipa/pull/1063
Author: stlaz
Title: #1063: [Backport][ipa-4-6] Fixing how sssd.conf is updated when promoting a client to replica
Action: opened
PR body:
"""
This PR was opened automatically because PR #1005 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1063/head:pr1063
git checkout pr1063
URL: https://github.com/freeipa/freeipa/pull/1049
Author: stlaz
Title: #1049: ldif: handle attribute names as strings
Action: opened
PR body:
"""
ldif.LDIFRecordList handles all attribute names as utf-8 strings
and all attribute values as bytes. If we take the attribute value
and try to search for it in the entry (= dictionary), if it contains
the attribute name as a key (which is a string), their hashes match.
However, even if hashes match, Python needs to make sure those two
are the same in case of a hash collision, so it tries to compare them.
This causes BytesWarning exception when running in strict mode
because `bytes` and `str` instances cannot be compared. KeyError
would be thrown in a non-strict mode.
Also, when later passing the attr to replace_value(), we need for it
to be `str` otherwise the modifications handler fails because it
tries to sort the attributes it's modifying but that's a bit less
poetic issue than the first one.
https://pagure.io/freeipa/issue/7129
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1049/head:pr1049
git checkout pr1049
URL: https://github.com/freeipa/freeipa/pull/1046
Author: stlaz
Title: #1046: pkinit: don't fail when no pkinit servers found
Action: opened
PR body:
"""
If we issue pkinit-status after an upgrade from a pre-4.5 ipa
version, it would have failed with KeyError since the
pkinit_server_server of IPA config was never initialized.
https://pagure.io/freeipa/issue/7144
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1046/head:pr1046
git checkout pr1046
URL: https://github.com/freeipa/freeipa/pull/1005
Author: felipevolpone
Title: #1005: Fixing how sssd.conf is updated when promoting a client to replica
Action: opened
PR body:
"""
When promoting a client to a replica we have to change sssd.conf, deleting _srv_ part from 'ipa_server' property and setting 'ipa_server_mode' to true.
Previously, the wrong domain could be updated since the ipa_domain variable was not being used properly.
https://bugzilla.redhat.com/show_bug.cgi?id=1478251
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1005/head:pr1005
git checkout pr1005
URL: https://github.com/freeipa/freeipa/pull/1060
Author: stlaz
Title: #1060: Backport PR 976 to ipa-4-6
Action: opened
PR body:
"""
This PR was opened automatically because PR #976 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1060/head:pr1060
git checkout pr1060
URL: https://github.com/freeipa/freeipa/pull/1055
Author: stlaz
Title: #1055: Backport PR 992 to ipa-4-6
Action: opened
PR body:
"""
This PR was opened automatically because PR #992 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1055/head:pr1055
git checkout pr1055
URL: https://github.com/freeipa/freeipa/pull/902
Author: felipevolpone
Title: #902: Improving replica promotion tests
Action: opened
PR body:
"""
Adding two new test cases in replica promotion scenario:
* Testing not interactive mode: Install client; kinit as admin;
then ipa-replica-install (without prompting a password)
* Testing interactive mode: only the admin password should be prompted
https://pagure.io/freeipa/issue/6554
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/902/head:pr902
git checkout pr902
URL: https://github.com/freeipa/freeipa/pull/1059
Author: stlaz
Title: #1059: Backport Travis workaround for ipa-4-5
Action: opened
PR body:
"""
Travis upgraded their environment but broke some deployments. Wait
for them to fix the issue with python3.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1059/head:pr1059
git checkout pr1059
URL: https://github.com/freeipa/freeipa/pull/1058
Author: stlaz
Title: #1058: Backport Travis workaround for ipa-4-6
Action: opened
PR body:
"""
Travis upgraded their environment but broke some deployments. Wait
for them to fix the issue with python3.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1058/head:pr1058
git checkout pr1058
URL: https://github.com/freeipa/freeipa/pull/992
Author: stlaz
Title: #992: Pylint fixes
Action: opened
PR body:
"""
Pylint check on Fedora 26 fails horribly with multitude of errors. This PR tries to fix that. Notice that to successfully run `pylint` on Fedora 26 with `make lint`, you need to have `python2-pylint` installed.
Fixes: https://pagure.io/freeipa/issue/6874
This PR should also unblock having Travis CI running in F26 container once https://bugzilla.redhat.com/show_bug.cgi?id=1483869 is fixed.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/992/head:pr992
git checkout pr992
URL: https://github.com/freeipa/freeipa/pull/1023
Author: flo-renaud
Title: #1023: Backport PR 1008 to ipa-4-5
Action: opened
PR body:
"""
Fix ipa-server-upgrade: This entry already exists
ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin
finds all CA certificates in /etc/httpd/alias and uploads them in LDAP
below cn=certificates,cn=ipa,cn=etc,$BASEDN.
The issue happens because there is already an entry in LDAP for IPA CA, but
with a different DN. The nickname in /etc/httpd/alias can differ from
$DOMAIN IPA CA.
To avoid the issue:
1/ during upgrade, run a new plugin that removes duplicates and restarts ldap
(to make sure that uniqueness attr plugin is working after the new plugin)
2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of
cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA.
https://pagure.io/freeipa/issue/7125
Reviewed-By: Fraser Tweedale <ftweedal(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1023/head:pr1023
git checkout pr1023
URL: https://github.com/freeipa/freeipa/pull/1021
Author: flo-renaud
Title: #1021: Backport PR 988 to ipa-4-5
Action: opened
PR body:
"""
Fix Certificate renewal (with ext ca)
Fix certificate renewal scripts that use IPACertificate object:
- renew_ca_cert adds the C flag to the trust flags and needs to
be adapted to IPACertificate object
- ipa-cacert-manage: fix python3 encoding issue
https://pagure.io/freeipa/issue/7106
Reviewed-By: Fraser Tweedale <ftweedal(a)redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1021/head:pr1021
git checkout pr1021
URL: https://github.com/freeipa/freeipa/pull/1051
Author: stlaz
Title: #1051: travis: temporary workaround for Travis CI
Action: opened
PR body:
"""
Travis upgraded their environment but broke some deployments. Wait
for them to fix the issue with python3.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1051/head:pr1051
git checkout pr1051
URL: https://github.com/freeipa/freeipa/pull/1048
Author: stlaz
Title: #1048: Backport PR 1044 to ipa-4-6
Action: opened
PR body:
"""
This PR was opened automatically because PR #1044 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1048/head:pr1048
git checkout pr1048
Hi all,
The first version of a new design document is available at
https://www.freeipa.org/page/V4/ClientInstallationWithAnsible
The feature will allow to deploy IPA clients using Ansible. Please feel
free to send your comments, suggestions or concerns.
Thanks,
Flo
URL: https://github.com/freeipa/freeipa/pull/1039
Author: tomaskrizek
Title: #1039: Backport PR 1001 to ipa-4-5
Action: opened
PR body:
"""
This PR was opened automatically because PR #1001 was pushed to master and backport to ipa-4-5 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1039/head:pr1039
git checkout pr1039
URL: https://github.com/freeipa/freeipa/pull/1040
Author: tomaskrizek
Title: #1040: Backport PR 1001 to ipa-4-6
Action: opened
PR body:
"""
This PR was opened automatically because PR #1001 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1040/head:pr1040
git checkout pr1040
URL: https://github.com/freeipa/freeipa/pull/1043
Author: stlaz
Title: #1043: Travis: archive logs of py3 jobs
Action: opened
PR body:
"""
If something fails, only the logs of python2 jobs are currently
collected. Collect python3 logs as well.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1043/head:pr1043
git checkout pr1043
URL: https://github.com/freeipa/freeipa/pull/1044
Author: pvomacka
Title: #1044: WebUI: Fix calling undefined method during reset passwords
Action: opened
PR body:
"""
When calling reset password the whoami command is not called in batch
command, therefore the result is different then in calling
during reset password operation. That needs to be handled to properly
set entity_show method which needs to be called after to gather
data about logged in entity.
https://pagure.io/freeipa/issue/7143
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1044/head:pr1044
git checkout pr1044
URL: https://github.com/freeipa/freeipa/pull/1038
Author: tomaskrizek
Title: #1038: Backport PR 1010 to ipa-4-6
Action: opened
PR body:
"""
This PR was opened automatically because PR #1010 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1038/head:pr1038
git checkout pr1038
URL: https://github.com/freeipa/freeipa/pull/1037
Author: tomaskrizek
Title: #1037: Backport PR 1010 to ipa-4-5
Action: opened
PR body:
"""
This PR was opened automatically because PR #1010 was pushed to master and backport to ipa-4-5 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1037/head:pr1037
git checkout pr1037
URL: https://github.com/freeipa/freeipa/pull/1001
Author: flo-renaud
Title: #1001: Fix ipa config-mod --ca-renewal-master
Action: opened
PR body:
"""
commit bddb90f38a3505a2768862d2f814c5e749a7dcde added the support for
multivalued server attributes (for pkinit_server_server), but this
introduced an API change where the setter and getter of ServerAttribute
are expecting list of values.
When a SingleValuedServerAttribute is used, we need to convert one elem
into a list containing this elem and vice-versa, so that the ipa config-mod
and ipa config_show APIs are not modified.
https://pagure.io/freeipa/issue/7120
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1001/head:pr1001
git checkout pr1001
URL: https://github.com/freeipa/freeipa/pull/1010
Author: pvomacka
Title: #1010: Adds whoami DS plugin in case that plugin is missing
Action: opened
PR body:
"""
When first installation of IPA has been done when whoami
plugin was not enabled in DS by default and then IPA was
upgraded to newer versions, then after upgrade to IPA 4.5
WebUI stops working. This is caused by new requirement on
whoami DS plugin which is used to obtain information about
logged in entity.
This fix adds check whether the plugin is enabled and if not
then IPA enables the plugin during upgrade.
https://pagure.io/freeipa/issue/7126
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1010/head:pr1010
git checkout pr1010
URL: https://github.com/freeipa/freeipa/pull/1036
Author: felipevolpone
Title: #1036: Fixing tox and pylint errors
Action: opened
PR body:
"""
Fixing import errors introduced by commit cac3475a0454b730d6e5b2093c2e63d395acd387.
https://pagure.io/freeipa/issue/7132
Output of tox commands:
<details>
<summary>tox -e py27</summary>
<p>
```
fbarreto@freeipa (fix-tox-imports) tox -e py27
py27 recreate: /home/fbarreto/projects/freeipa/.tox/py27
py27 installdeps: ipaclient[csrgen], ipatests
py27 installed: asn1crypto==0.22.0,cffi==1.10.0,cryptography==2.0.3,decorator==4.1.2,dnspython==1.15.0,enum34==1.1.6,gssapi==1.2.0,idna==2.6,ipaclient==4.6.90.dev201709041448+gitac6e4cb61,ipaddress==1.0.18,ipalib==4.6.90.dev201709041448+gitac6e4cb61,ipapython==4.6.90.dev201709041448+gitac6e4cb61,ipatests==4.6.90.dev201709041448+gitac6e4cb61,Jinja2==2.9.6,MarkupSafe==1.0,netaddr==0.7.19,netifaces==0.10.6,nose==1.3.7,polib==1.0.8,py==1.4.34,pyasn1==0.3.3,pyasn1-modules==0.1.1,pycparser==2.18,pytest==3.2.1,pytest-multihost==1.1.1,python-ldap==2.4.42,qrcode==5.3,six==1.10.0
py27 runtests: PYTHONHASHSEED='3471542700'
py27 runtests: commands[0] | /home/fbarreto/projects/freeipa/.tox/py27/bin/ipa --help
Usage: ipa [global-options] COMMAND [command-options]
Manage an IPA domain
Options:
--version show program's version number and exit
-h, --help Show this help message and exit
-e KEY=VAL Set environment variable KEY to VAL
-c FILE Load configuration from FILE.
-d, --debug Produce full debuging output
--delegate Delegate the TGT to the IPA server
-v, --verbose Produce more verbose output. A second -v displays the
XML-RPC request
-a, --prompt-all Prompt for ALL values (even if optional)
-n, --no-prompt Prompt for NO values (even if required)
-f, --no-fallback Only use the server configured in /etc/ipa/default.conf
See "ipa help topics" for available help topics.
See "ipa help <TOPIC>" for more information on a specific topic.
See "ipa help commands" for the full list of commands.
See "ipa <COMMAND> --help" for more information on a specific command.
py27 runtests: commands[1] | /home/fbarreto/projects/freeipa/.tox/py27/bin/python -bb /home/fbarreto/projects/freeipa/.tox/py27/bin/ipa-run-tests --ipaclient-unittests
========================================== test session starts ==========================================
platform linux2 -- Python 2.7.13, pytest-3.2.1, py-1.4.34, pluggy-0.4.0
rootdir: /home/fbarreto/projects/freeipa/.tox/py27/lib/python2.7/site-packages/ipatests, inifile:
plugins: multihost-1.1.1
collected 451 items / 285 skipped
test_util.py ........
util.py ..
test_ipaclient/test_csrgen.py .................
test_ipalib/test_aci.py ...................
test_ipalib/test_backend.py ........
test_ipalib/test_base.py ...............
test_ipalib/test_capabilities.py .
test_ipalib/test_cli.py ...
test_ipalib/test_config.py ...............
test_ipalib/test_crud.py ...............
test_ipalib/test_errors.py .......
test_ipalib/test_frontend.py ........................................
test_ipalib/test_messages.py ....
test_ipalib/test_output.py ...
test_ipalib/test_parameters.py .............................................................
test_ipalib/test_plugable.py ........
test_ipalib/test_rpc.py ......ssssssss
test_ipalib/test_text.py .............................
test_ipalib/test_x509.py ...
test_ipapython/test_cookie.py ............
test_ipapython/test_dn.py ............................
test_ipapython/test_ipautil.py ..................................................................
test_ipapython/test_ipavalidate.py ..........
test_ipapython/test_kerberos.py ..............
test_ipapython/test_keyring.py ..........
test_ipapython/test_session_storage.py sss
test_ipapython/test_ssh.py ...............................
test_pkcs10/test_pkcs10.py .....
=============================== 440 passed, 296 skipped in 14.63 seconds ================================
________________________________________________ summary ________________________________________________
py27: commands succeeded
congratulations :)
```
</p>
</details>
<details>
<summary>tox -e pylint2</summary>
<p>
```
fbarreto@freeipa (fix-tox-imports) tox -e pylint2
pylint2 recreate: /home/fbarreto/projects/freeipa/.tox/pylint2
pylint2 installdeps: ipaclient[csrgen,otptoken_yubikey], pylint
pylint2 installed: asn1crypto==0.22.0,astroid==1.4.9,backports.functools-lru-cache==1.4,cffi==1.10.0,configparser==3.5.0,cryptography==2.0.3,decorator==4.1.2,dnspython==1.15.0,enum34==1.1.6,gssapi==1.2.0,idna==2.6,ipaclient==4.6.90.dev201709041448+gitac6e4cb61,ipaddress==1.0.18,ipalib==4.6.90.dev201709041448+gitac6e4cb61,ipapython==4.6.90.dev201709041448+gitac6e4cb61,isort==4.2.15,Jinja2==2.9.6,lazy-object-proxy==1.3.1,MarkupSafe==1.0,mccabe==0.6.1,netaddr==0.7.19,netifaces==0.10.6,pyasn1==0.3.3,pyasn1-modules==0.1.1,pycparser==2.18,pylint==1.6.5,python-ldap==2.4.42,python-yubico==1.3.2,pyusb==1.0.0,qrcode==5.3,six==1.10.0,wrapt==1.10.11
pylint2 runtests: PYTHONHASHSEED='2133013788'
pylint2 runtests: commands[0] | /home/fbarreto/projects/freeipa/.tox/pylint2/bin/python -m pylint --rcfile=/home/fbarreto/projects/freeipa/pylintrc --load-plugins pylint_plugins /home/fbarreto/projects/freeipa/.tox/pylint2/lib/python2.7/site-packages/ipaclient /home/fbarreto/projects/freeipa/.tox/pylint2/lib/python2.7/site-packages/ipalib /home/fbarreto/projects/freeipa/.tox/pylint2/lib/python2.7/site-packages/ipapython
________________________________________________ summary ________________________________________________
pylint2: commands succeeded
congratulations :)
```
</p>
</details>
<details>
<summary>tox -e py35</summary>
<p>
```
fbarreto@freeipa (fix-tox-imports) tox -e py35
py35 create: /home/fbarreto/projects/freeipa/.tox/py35
py35 installdeps: ipaclient[csrgen], ipatests
py35 installed: asn1crypto==0.22.0,cffi==1.10.0,cryptography==2.0.3,decorator==4.1.2,dnspython==1.15.0,gssapi==1.2.0,idna==2.6,ipaclient==4.6.90.dev201709041448+gitac6e4cb61,ipalib==4.6.90.dev201709041448+gitac6e4cb61,ipapython==4.6.90.dev201709041448+gitac6e4cb61,ipatests==4.6.90.dev201709041448+gitac6e4cb61,Jinja2==2.9.6,MarkupSafe==1.0,netaddr==0.7.19,netifaces==0.10.6,nose==1.3.7,polib==1.0.8,py==1.4.34,pyasn1==0.3.3,pyasn1-modules==0.1.1,pycparser==2.18,pyldap==2.4.37,pytest==3.2.1,pytest-multihost==1.1.1,qrcode==5.3,six==1.10.0
py35 runtests: PYTHONHASHSEED='3317488747'
py35 runtests: commands[0] | /home/fbarreto/projects/freeipa/.tox/py35/bin/ipa --help
Usage: ipa [global-options] COMMAND [command-options]
Manage an IPA domain
Options:
--version show program's version number and exit
-h, --help Show this help message and exit
-e KEY=VAL Set environment variable KEY to VAL
-c FILE Load configuration from FILE.
-d, --debug Produce full debuging output
--delegate Delegate the TGT to the IPA server
-v, --verbose Produce more verbose output. A second -v displays the
XML-RPC request
-a, --prompt-all Prompt for ALL values (even if optional)
-n, --no-prompt Prompt for NO values (even if required)
-f, --no-fallback Only use the server configured in /etc/ipa/default.conf
See "ipa help topics" for available help topics.
See "ipa help <TOPIC>" for more information on a specific topic.
See "ipa help commands" for the full list of commands.
See "ipa <COMMAND> --help" for more information on a specific command.
py35 runtests: commands[1] | /home/fbarreto/projects/freeipa/.tox/py35/bin/python -bb /home/fbarreto/projects/freeipa/.tox/py35/bin/ipa-run-tests --ipaclient-unittests
========================================== test session starts ==========================================
platform linux -- Python 3.5.3, pytest-3.2.1, py-1.4.34, pluggy-0.4.0
rootdir: /home/fbarreto/projects/freeipa/.tox/py35/lib/python3.5/site-packages/ipatests, inifile:
plugins: multihost-1.1.1
collected 451 items / 285 skipped
test_util.py ........
util.py ..
test_ipaclient/test_csrgen.py .................
test_ipalib/test_aci.py ...................
test_ipalib/test_backend.py ........
test_ipalib/test_base.py ...............
test_ipalib/test_capabilities.py .
test_ipalib/test_cli.py ...
test_ipalib/test_config.py ...............
test_ipalib/test_crud.py ...............
test_ipalib/test_errors.py .......
test_ipalib/test_frontend.py ........................................
test_ipalib/test_messages.py ....
test_ipalib/test_output.py ...
test_ipalib/test_parameters.py .............................................................
test_ipalib/test_plugable.py ........
test_ipalib/test_rpc.py ......ssssssss
test_ipalib/test_text.py .............................
test_ipalib/test_x509.py ...
test_ipapython/test_cookie.py ............
test_ipapython/test_dn.py ............................
test_ipapython/test_ipautil.py ....................................s.............................
test_ipapython/test_ipavalidate.py ..........
test_ipapython/test_kerberos.py ..............
test_ipapython/test_keyring.py ..........
test_ipapython/test_session_storage.py sss
test_ipapython/test_ssh.py ...............................
test_pkcs10/test_pkcs10.py .....
=============================== 439 passed, 297 skipped in 15.41 seconds ================================
________________________________________________ summary ________________________________________________
py35: commands succeeded
congratulations :)
```
</p>
</details>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1036/head:pr1036
git checkout pr1036
URL: https://github.com/freeipa/freeipa/pull/1035
Author: pvomacka
Title: #1035: WebUI: ID user override causes traceback in httpd/error_log
Action: opened
PR body:
"""
The 'ipaanchoruuid' is link widget and it had set 'other_entity'
attribute to 'user'. That means that WebUI automatically checks
whether the created link is available (whether there is an existing
user with the name set as value of the 'ipaanchoruuid' field).
The user with that name is not obviously found because it tries to
find a user while the value is ipaanchoruuid (AD user).
Removing 'other_entity' from specification tells WebUI to not
check the link.
The link widget is even set to non-clicable state. So the check does not
makes sense now.
https://pagure.io/freeipa/issue/7139
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1035/head:pr1035
git checkout pr1035
The FreeIPA team would like to announce FreeIPA 4.6.0 release!
It can be downloaded from https://releases.pagure.org/freeipa/. Builds for
Fedora 25 and 26 will be available in the officialCOPR repository
https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/ .
== Highlights in 4.6.0 ==
=== Enhancements ===
* Python 3 is now supported.
=== Known Issues ===
* WebUI doesn't work [#7126, #7127]
* Attempting un-installation if IPA isn't installed prints confusing
strings [#7063]
=== Bug fixes ===
Contains all bugfixes and enhancements of 4.5.1, 4.5.2 and 4.5.3 releases.
== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users
mailing
list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 7123 External CA renewal fails when IPA CA subject DN does not match
"CN=Certificate Authority, {subject-base}"
* 7116 dnssec: fix localhsm.py with openhsm >= 2.2.0
* 7108 ipa-backup broken because of cyclic import
* 7086 [ipatests] - add caless to cafull tests
* 7066 WebUI: All columns of user in group table are clickable
* 7035 ipa-otptoken-import - XML file is missing PBKDF2 parameters!
* 7017 NULL LDAP context in call to ldap_search_ext_s during search in
cn=ad,cn=trusts,dc=example,dc=com
* 6605 make lint + make modifies PO files in place
* 6582 Web UI: Change "Host Based" and "Role Based" to "Host-Based" and
"Role-Based"
* 6447 [WebUI] Remove offline version of WebUI
* 6261 Replace ERROR: cannot connect to
'http://localhost:8888/ipa/json': [Errno 111] Connection refused with
'IPA is not configured on this system'
* 6176 Updating of dns system records rapidly slowdown uninstallation
* 7121 ipa otptoken-add-yubikey fails with python3
* 7118 Fix CA-less installation due to incorrect with statement
* 7110 Missing requirement in freeipa 4.5.90.dev201708161122+git799551892-0
* 7100 test_caless: add SAN dNSName extensions for wildcard tests
* 7088 Use X509v3 Basic Constraints "CA:TRUE" instead of "CA:FALSE" IPA
CA CSR
* 7076 Adjust to CURL whichs started to use OpenSSL -
ipa-server-install fails to obtain RA certificate from CA (CA_UNREACHABLE)
* 7053 Replica install fails to configure IPA-specific temporary
files/directories
* 7052 WebUI: search facet spec actions contains 'undefined' item
* 7051 ipapython/graph.py complexity optimization
* 7050 Type error when running tests for whoami command.
* 7046 missing default basedn causes failure during initialization of
multi host tests
* 7030 tests: CA-less test suite broken due to missing subject key
identifier extension
* 7011 --force-join option is not mentioned in ipa-replica-install man page
* 7010 ipa-backup fails silently
* 7002 adtrustinstance: broken ID range assessment
* 6987 ca-add: invalid X.509 DN fails ungracefully
* 6986 make pylint is not working on F26
* 6980 Pagination Size under Customization in IPA WebUI accepts negative
values
* 6976 External CA: check that IPA CA certificate contains Subject Key
Identifier
* 6974 WebUI: Fix unit webUI tests
* 6971 ipatests: collect systemd journal
* 6956 Backup and restore tests faliling
* 6946 ipa-replica-manage del (dl 0) doesn't remove server from
defaultServerList
* 6945 Bring back error messages from certificate validation
* 6943 server-del doesn't remove server from defaultServerList in
cn=default,ou=profile,$BASE
* 6940 installer should indicate that it is waiting for keys
* 6939 ipaserver.plugins.host.get_dn timeout due to unindexed search
* 6928 ipa-managed-entries incorrectly states server not installed
* 6865 minor spelling mistake in ipa-adtrust-install.1
* 6863 minor spelling mistake
* 6852 [RFE] Create client enrollment role
* 6849 Priority field missing in required field incicator - *
* 6845 ipa-otpd.socket.in has wrong kdc service name for Debian
* 6834 ipa-kdc-proxy.conf.template hardcodes python module directory
* 6822 git-commit-template: update ticket URL to use pagure.io instead
of fedorahosted.org
* 6818 Update asn1c code in /asn1/asn1c
* 6809 Failed to write schema: b'sudo/1' is not JSON serializable
* 6745 [test] ipa whoami command
* 6725 No page for information on build from source
* 6642 Py3: test_serverroles: use ldap2/ldapclient instead of MockLDAP
* 6591 pytest 3.0: yield tests are deprecated
* 5990 Py3: zonemgr_callback: expected unicode, got bytes
* 5919 cert-request rfc822Name check compares whole email address
case-sensitively
* 4985 [RFE] Support Python 3
== Detailed changelog since 4.5.3 ==
=== Alexander Bokovoy (13) ===
* csrgen: support openssl 1.0 and 1.1
* dcerpc: support Python 3
* ipa-sam: use smbldap_set_bind_callback for Samba 4.7 or later
* ipa-sam: use own private structure, not ldapsam_privates
* trust-mod: allow modifying list of UPNs of a trusted forest
* ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
* Fix index definition for ipaAnchorUUID
* krb5: make sure KDC certificate is readable
* trust: always use oddjobd helper for fetching trust information
* ipaserver/dcerpc: unify error processing
* adtrust: make sure that runtime hostname result is consistent with the
configuration
* server: make sure we test for sss_nss_getlistbycert
* ldap2: use LDAP whoami operation to retrieve bind DN for current
connection
=== Abhijeet Kasurde (6) ===
* Vault testcase improvement
* Minor typo fixes
* Minor typo in details.js
* Hide request_type doc string in cert-request help
* Hide PKI Client database password in log file
* Use with statement for opening file
=== Alex Zeleznikov (1) ===
* Sort SRV records by priority
=== Aleksei Slaikovskii (3) ===
* ipapython/graph.py redundant variable fix
* ipapython/graph.py String formatting
* ipapython/graph.py complexity optimization
=== Ben Lipton (4) ===
* csrgen: Beginnings of NSS database support
* csrgen: Modify cert_get_requestdata to return a CertificationRequestInfo
* csrgen: Change to pure openssl config format (no script)
* csrgen: Remove helper abstraction
=== Christian Heimes (40) ===
* Misc Python 3 fixes for ipaserver.secrets
* Reimplement yield tests are parametrized tests
* Silence pytest.yield_fixture deprecation warning
* Slim down dependencies
* Vault: Explicitly default to 3DES CBC
* Band-aid for pip dependency bug
* Correct PyPI package dependencies
* tox: use pylint 1.6.x for now
* Replace _BSD_SOURCE with _DEFAULT_SOURCE
* Regenerate ASN.1 code with asn1c 0.9.28
* tox testing support for client wheel packages
* Stabilize make pypi_packages
* Replace hard-coded kdcproxy path with WSGI script
* Use entry_points for ipa CLI
* Don't hard-code with_wheels
* Add an option to build ipaserver wheels
* Add extra_requires for additional dependencies
* Conditionally import pyhbac
* Skip test_session_storage in ipaclient unittest mode
* Add make devcheck for developers
* session storage parameters must be bytes
* Fix ipatests.util doc tests
* Use Custodia 0.3.1 features
* Simplify KRA transport cert cache
* pytest 3.x compatibility
* Constrain wheel package versions
* Move remaining util functions to tasks module
* Ship ipatests.pytest_plugins.integration
* Move function run_repeatedly to tasks module
* Move hosts module to ipatests.pytest_plugins.integration.hosts
* Move tasks module to ipatests.pytest_plugins.integration.tasks
* Move env_config module to ipatests.pytest_plugins.integration.env_config
* Move config module to ipatests.pytest_plugins.integration.config
* Move helper code for integration plugin
* Increase Apache HTTPD's default keep alive timeout
* Add debug logging for keep-alive
* Use connection keep-alive
* Add options to run only ipaclient unittests
* Python 3: Fix session storage
* Fix Python 3 pylint errors
=== David Kreitschmann (4) ===
* Disable pylint in get_help function because of type confusion.
* Store help in Schema before writing to disk
* Use os.fsync instead of os.fdatasync because macOS doesn't support
fdatasync
* Fix libkrb5 filename for macOS
=== David Kupka (22) ===
* tests: certmap: Add test for user-{add,remove}-certmap
* tests: tracker: Add CertmapdataMixin tracker
* tests: certmap: Add test for certmapconfig-{mod,show}
* tests: tracker: Add CertmapconfigTracker to tests certmapconfig-* commands
* tests: certmap: Test permissions for certmap
* tests: certmap: Add basic tests for certmaprule commands
* tests: tracker: Add CertmapTracker for testing certmap-* commands
* tests: tracker: Add ConfigurationTracker to test *config-{mod,show}
commands
* tests: tracker: Add EnableTracker to test *-{enable,disable} commands
* tests: tracker: Split Tracker into one-purpose Trackers
* install: replica: Show message about key synchronization
* kra: promote: Get ticket before calling custodia
* ipapython.ipautil.run: Add option to set umask before executing command
* otptoken-add-yubikey: When --digits not provided use default value
* Bump version of ipa.conf file
* Create system users for FreeIPA services during package installation
* WebUI: cert login: Configure name of parameter used to pass username
* httpinstance.disable_system_trust: Don't fail if module 'Root Certs'
is not available
* spec file: Bump requires to make Certificate Login in WebUI work
* rpcserver.login_x509: Actually return reply from __call__ method
* Create temporaty directories at the begining of uninstall
* ipapython.ipautil.nolog_replace: Do not replace empty value
=== felipe (1) ===
* Fixing replica install: fix ldap connection in domlvl 0
=== Felipe Volpone (3) ===
* Removing part of circular dependency of ipalib in ipaplaform
* Changing how commands handles error when it can't connect to IPA server
* py3: fixing zonemgr_callback
=== Felipe Volpone (5) ===
* Adding section "Building FreeIPA from source" on README
* Changing cert-find to go through the proxy instead of using the port 8080
* Changing cert-find to do not use only primary key to search in LDAP.
* Fixing adding authenticator indicators to host
* Fixing the cert-request comparing whole email address case-sensitively.
=== Fabiano Fidêncio (1) ===
* Allow erasing ipaDomainResolutionOrder attribute
=== Florence Blanc-Renaud (22) ===
* Fix Certificate renewal (with ext ca)
* Fix ipa-server-upgrade: This entry already exists
* ipa-replica-conncheck: handle ssh not installed
* ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
* ipa-replica-manage del (dl 0): remove server from defaultServerList
* server-del: update defaultServerList in cn=default,ou=profile,$BASE
* ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
* ipa-server-install: fix uninstall
* ipa-kra-install manpage: document domain-level 1
* ipa-kra-install: fix check_host_keys
* ipa-server-install with external CA: fix pkinit cert issuance
* ipa-client-install: remove extra space in pkinit_anchors definition
* vault: piped input for ipa vault-add fails
* upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
* tests: add non-reg for idrange-add
* Upgrade: add gidnumber to trusted domain entry
* ipa-sam: create the gidNumber attribute in the trusted domain entry
* idrange-add: properly handle empty --dom-name option
* ipa-ca-install man page: Add domain level 1 help
* git-commit-template: update ticket url to use pagure.io instead of
fedorahosted.org
* dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
* man ipa-cacert-manage install needs clarification
=== Fraser Tweedale (14) ===
* Fix external renewal for CA with non-default subject DN
* py3: handle bytes in schema response
* py3: fix vault public key decoding
* cert: fix application of 'str' to bytes when formatting otherName
* py3: fix schema response for py2 server with py3 client
* Fix incorrect 'with' statement in CA-less installation
* Restore old version of caIPAserviceCert for upgrade only
* cert-request: simplify request processing
* Add CommonNameToSANDefault to default cert profile
* Add a README to certificate profile templates directory
* py3: fix regression in schemaupdate
* ca-add: validate Subject DN name attributes
* Add Subject Key Identifier to CA cert validity check
* Support 8192-bit RSA keys in default cert profile
=== Jan Cholasta (61) ===
* pylint: enable logging checks
* logging: do not use `ipa_log_manager` to create module-level loggers
* logging: do not log into the root logger
* logging: do not reference loggers in arguments and attributes
* doc: sync guide.org with cli.py
* logging: remove object-specific loggers
* logging: use the actual root logger as the root logger
* logging: port to standard Python logging
* logging: do not configure any handlers by default
* wsgi, oddjob: remove needless uses of Env
* config: provide defaults for `xmlrpc_uri`, `ldap_uri` and `basedn`
* ldap2: remove URI argument from ldap2 constructor
* test_ldap: drop redundant URI argument
* {ca,kra}instance: drop redundant URI argument from ad-hoc ldap2
connections
* user, migration: use LDAPClient for ad-hoc LDAP connections
* install: do not assume /etc/krb5.conf.d exists
* server upgrade: do not enable PKINIT by default
* pkinit manage: introduce ipa-pkinit-manage
* server certinstall: update KDC master entry
* httpinstance: wait until the service entry is replicated
* server certinstall: support PKINIT
* cacert manage: support PKINIT
* replica install: respect --pkinit-cert-file
* server install: fix KDC certificate validation in CA-less
* certs: do not export CA certs in install_pem_from_p12
* certs: do not export keys world-readable in install_key_from_p12
* server install: fix KDC PKINIT configuration
* install: introduce generic Kerberos Augeas lens
* client install: fix client PKINIT configuration
* install: trust IPA CA for PKINIT
* certdb: use custom object for trust flags
* certdb, certs: make trust flags argument mandatory
* certdb: add named trust flag constants
* ipa-cacert-manage: add --external-ca-type
* renew agent: get rid of virtual profiles
* renew agent: always export CSR on IPA CA certificate renewal
* renew agent: allow reusing existing certs
* cainstance: use correct profile for lightweight CA certificates
* server upgrade: always fix certmonger tracking request
* renew agent: respect CA renewal master setting
* spec file: bump krb5 Requires for certauth fixes
* spec file: bump python-netaddr Requires
* configure: fix AC_CHECK_LIB usage
* cert: defer cert-find result post-processing
* renew agent, restart scripts: connect to LDAP after kinit
* renew agent: revert to host keytab authentication
* install: request service certs after host keytab is set up
* dsinstance, httpinstance: consolidate certificate request code
* httpinstance: avoid httpd restart during certificate request
* dsinstance: reconnect ldap2 after DS is restarted by certmonger
* httpinstance: make sure NSS database is backed up
* certdb: fix `AttributeError` in `verify_ca_cert_validity`
* setup, pylint, spec file: drop python-nss dependency
* certdb: use certutil and match_hostname for cert verification
* spec file: bump libsss_nss_idmap-devel BuildRequires
* spec file: bump krb5-devel BuildRequires for certauth
* cert: do not limit internal searches in cert-find
* replica prepare: fix wrong IPA CA nickname in replica file
* httpinstance: clean up /etc/httpd/alias on uninstall
* certs: do not implicitly create DS pin.txt
* tasks: run `systemctl daemon-reload` after httpd.service.d updates
=== René Genz (3) ===
* fix minor spelling mistakes
* fix spelling mistake; minor rewording
* fix minor typos in ipa-adtrust-install.1
=== Martin Babinsky (45) ===
* Move tmpfiles.d configuration handling back to spec file
* Do not remove the old masters when setting the attribute fails
* *config-show: Do not show empty roles/attributes
* smart-card-advises: ensure that krb5-pkinit is installed on client
* smart card advise: use password when changing trust flags on HTTP cert
* smart card advises: use a wrapper around Bash `for` loops
* Use the compound statement formatting API for configuring PKINIT
* Fix indentation of statements in Smart card advises
* delegate formatting of compound Bash statements to dedicated classes
* advise: add an infrastructure for formatting Bash compound statements
* delegate the indentation handling in advises to dedicated class
* add a class that tracks the indentation in the generated advises
* Allow to pass in multiple CA cert paths to the smart card advises
* smart-card advises: add steps to store smart card signing CA cert
* smart-card advises: configure systemwide NSS DB also on master
* Prepare advise plugin for smart card auth configuration
* Extend the advice printing code by some useful abstractions
* fix incorrect suffix handling in topology checks
* Do not delete DS and PKI users during backup/restore tests
* test_backup_restore: do not fail on missing KrbLastSuccessfulAuth
* only stop/disable simple service if it is installed
* test_serverroles: Get rid of MockLDAP and use ldap2 instead
* Add `pkinit-status` command
* Add the list of PKINIT servers as a virtual attribute to global config
* Add an attribute reporting client PKINIT-capable servers
* Refactor the role/attribute member reporting code
* Allow for multivalued server attributes
* Travis CI: Add the server uninstaller as a last step of tests
* Travis CI: explicitly update pip before running the builds
* Do not test anonymous PKINIT after install/upgrade
* Upgrade: configure local/full PKINIT depending on the master status
* Use local anchor when armoring password requests
* Stop requesting anonymous keytab and purge all references of it
* Use only anonymous PKINIT to fetch armor ccache
* API for retrieval of master's PKINIT status and publishing it in LDAP
* Allow for configuration of all three PKINIT variants when deploying KDC
* separate function to set ipaConfigString values on service entry
* Revert "Store GSSAPI session key in /var/run/ipa"
* Remove duplicate functionality in upgrade
* Always check and create anonymous principal during KDC install
* Ensure KDC is propery configured after upgrade
* Split out anonymous PKINIT test to a separate method
* Remove unused variable from failed anonymous PKINIT handling
* Upgrade: configure PKINIT after adding anonymous principal
* Travis CI: invoke integration test helper scripts before test execution
=== Martin Basti (63) ===
* DNS update: reduce timeout for CA records
* baseldap: fix format string
* IPAOptionParser: fix dict comprehension
* py3: run already ported scripts under py3 by default
* py3: temporary set dependencies to both py2 and py3 packages
* py3: test_otptoken_import: fix bytes usage
* py3: ipa_otptoken_import: fix hex decoding
* py3: ipa_otptoken_import: fix calling unicode on bytes
* py3: ipa_otptoken_import: fix lamba code inspection
* py3: Remove comparison >=2 of debnug log level
* py3: vault: data must be bytes
* py3: test_location_plugin: fix iteration over changed dict
* py3: test_kerberos_principal_aliases: fix code scope
* py3: dogtag.py: fix bytes warnings
* py3: travis: enable tests for plugins that are aleready working
* py3: secrets: remove iteritems usage
* Travis: check for BytesWarnings in httpd error_log
* py3: ipaldap: fix encoding of datetime objects
* py3: LDAPClient: remove __del__ method
* LDAPEntry: rename _orig to _orig_raw
* python-netifaces: update to reflect upstream changes
* Travis: enable temporary Py3 testing
* Travis: build only py2 packages for py2 testing
* Build: allow to build only py2 rpms for fedora
* Remove network and broadcast address warnings
* replica install: add missing check for non-local IP address
* Remove ip_netmask from option parser
* CheckedIPAddress: remove match_local param
* refactor CheckedIPAddress class
* ipa-dns-install: remove check for local ip address
* Fix local IP address validation
* Explicitly ask for py2 dependencies in py2 packages
* Only warn when specified server IP addresses don't match intf
* pylint: explicitly depends on python2-pylint
* py3: update_mod_nss_cipher_suite: ordering doesn't work with None
* py3: urlfetch: use "file://" prefix with filenames
* py3: cainstance: fix BytesWarning
* py3: schemaupdate: fix BytesWarning
* py3: LDAP updates: use only bytes/raw values
* py3: softhsm key_id must be bytes
* py3: ipaldap: encode Boolean as bytes
* py3: ConfigParser: replace deprecated readfd with read
* py3: use ConfigParser instead of SafeConfigParser
* Add remote_plugins subdirectories to RPM
* custodia dep: require explictly python2 version
* pylint: ignore new checks added in 1.7
* Pylint: fix ipa_forbidden_import checker
* travis: fix pylint execution with py3
* py3: add missing py3 pylint depedencies
* adtrust: move SELinux settings to constants
* httpd: move SELinux settings to constants
* ipasetup: fix dependencies handling based on python version
* ipaclient: fix missing RPM ownership
* tests: add missing dependency iptables
* ca_status: add HTTP timeout 30 seconds
* http_request: add timeout option
* Use proper SELinux context with http.keytab
* Store GSSAPI session key in /var/run/ipa
* Fix PKCS11 helper
* Remove surplus 'the' in output of ipa-adtrust-install
* collect audit.log for easier selinux investigation
* Set "KDC:Disable Last Success" by default
* Set development version to 4.5.90
=== Lewis Eason (1) ===
* Correct typo estabilish->establish in the install scripts
=== Michal Reznik (9) ===
* test_caless: add SAN dNSName extensions for wildcard tests
* test_caless: add replica ca-less to ca-full test (master caless)
* test_caless: add server_replica ca-less to ca-full test
* tests: fix external_ca test suite failing due to missing SKI
* test_caless: remove xfail in wildcard certificate tests
* test_caless: introduce new python makepki + fix SKI extension issue
* test_caless: mark TestCertinstall intermediate CA tests as xfail
* test_caless: add pkinit option and test it
* - added krb5kdc.log to pytest logging
=== Nathaniel McCallum (1) ===
* ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
=== Oliver Gutierrez (1) ===
* Added plugins directory to paclient subpackages
=== Petr Spacek (1) ===
* ipalib.constants: Remove default domain, realm, basedn, xmlrpc_uri,
ldap_uri
=== Petr Vobornik (5) ===
* log progress of wait_for_open_ports
* control logging of host_port_open from caller
* kerberos session: use CA cert with full cert chain for obtaining cookie
* restore: restart/reload gssproxy after restore
* automount install: fix checking of SSSD functionality on uninstall
=== Pavel Vomacka (34) ===
* Fixes bug in actions creating for search facet
* WebUI: fix showing required asterisk '*'
* WebUI: Update unit test README
* Fixes details_test.js
* Fixes for widget_tests.js
* Fixes for aci_tests.js
* Fixes for entity_tests.js
* Fixes for ipa_test.js
* Add up to date JSON files
* Add loader.js into requirements of all HTML unit test files
* WebUI: remove creating js/libs symlink from makefile
* WebUI: Remove plugins symlink as it is unused
* Remove all old JSON files
* Revert "Web UI: Remove offline version of Web UI"
* WebUI: Add hyphenate versions of Host(Role) Based strings
* WebUI: fix incorrectly shown links in association tables
* WebUI: fix jslint error
* WebUI: change validator of page size settings
* WebUI: Add positive number validator
* WebUI: add support for changing trust UPN suffixes
* Bump version of python-gssapi
* Turn off OCSP check
* Change python-cryptography to python2-cryptography
* Turn on NSSOCSP check in mod_nss conf
* WebUI - Coverity: fix identical branches of if statement
* WebUI - Coverity: fixed null pointer exception
* WebUI: Coverity - add explicit window object to alert methods
* WebUI: Allow to add certs to certmapping with CERT LINES around
* WebUI: Fix showing vault in selfservice view
* WebUI: suppress truncation warning in select widget
* WebUI: Add support for suppressing warnings
* WebUI: Add support for login for AD users
* WebUI: add method for disabling item in user dropdown menu
* WebUI: check principals in lowercase
=== Rob Crittenden (2) ===
* Include the CA basic constraint in CSRs when renewing a CA
* Pass ipa-ca-agent credentials as PEM files
=== Gabe (2) ===
* Update get_attr_filter in LDAPSearch to handle nsaccountlock user searches
* Add --password-expiration to allow admin to force user password expiration
=== Sumit Bose (11) ===
* ipa_pwd_extop: do not generate NT hashes in FIPS mode
* ipa-sam: replace encode_nt_key() with E_md4hash()
* ipa-kdb: use canonical principal in certauth plugin
* ipa-kdb: reload certificate mapping rules periodically
* IPA-KDB: use relative path in ipa-certmap config snippet
* extdom: improve cert request
* extdom: do reverse search for domain separator
* ipa-kdb: do not depend on certauth_plugin.h
* configure: fix --disable-server with certauth plugin
* IPA certauth plugin
* ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
=== Simo Sorce (12) ===
* Always check peer has keys before connecting
* Make sure we check ccaches in all rpcserver paths
* Revert setting sessionMaxAge for old clients
* Add code to be able to set default kinit lifetime
* Fix rare race condition with missing ccache file
* Make sure remote hosts have our keys
* Fix s4u2self with adtrust
* Prevent churn on ccaches
* Work around issues fetching session data
* Handle failed authentication via cookie
* Avoid growing FILE ccaches unnecessarily
* Add options to allow ticket caching
=== Stanislav Laznicka (97) ===
* spec: remove strict options from shebangs
* spec: have the scripts depend on py3 packages
* spec: remove python3 workaround
* Remove unused variable
* certmonger: remove temporary workaround
* cert: fix wrong assumption of cert-show result type
* rpc: don't encode bytes
* py3: Fix searching for yubikeys
* py3: remove relative import
* py3: remove Exception.message appearances
* Fix cert file creation during CA-less installation
* Uninstall: fix BytesWarning exception
* Unify storing certificates in LDAP
* py3: fix caless to CA promotion on replica
* cacert_manage: fix CA cert renewal
* python3: port certmonger requests script
* crtmgr: fix bug if CERTMONGER_CERTIFICATE not set
* certmonger: finish refactoring for request script
* certmonger: fix storing retrieved certificates
* Make the IPA server run under Python 3 by default
* Turn IPA scripts to python3 -bb for testing
* py3: Depend on newer pyldap for server-upgrade
* ipautil: port host_port_open() to python 3
* conncheck: fix progression on failure
* kerberos: fix sorting Principal objects
* host, service: fix adding host/svc with a cert
* server plugin: pass bytes to ldap.modify_s
* replica: fix SetuptoolsVersion comparison
* replica-prepare: run the script in py3 by default
* certs: write and read bytes as such
* client: make ipa-client-install py3 compatible
* cainstance: read cert file as bytes
* ca: TypeError fix
* krainstance: fix writing str to file
* replica-conncheck: log when failed to RPC connect
* Fixup of not-so-good PEM certs
* x509,certdb: handle certificates as bytes
* Create a Certificate parameter
* parameters: relax type checks
* tests: fix failing HTTPS connection
* Introduce load_unknown_x509_certificate()
* x509: Make certificates represented as objects
* Split x509.load_certificate() into PEM/DER functions
* README: Fix trailing whitespace
* Ensure network is online prior to an upgrade
* rpcserver: remove addition of str and bytes
* wsgi plugins: mod_wsgi expects bytes as an output
* adtrustinstance: write the conf as a string
* adtrustinstance: pep8 fix
* More verbose error message on kdc cert validation
* cert-validate: keep all messages in cert validation
* adtrustinstance: fix ID range comparison
* Docstring+refactor of IPADiscovery.ipadnssearchkrbrealm()
* ipadiscovery: Return realm as a string
* session_storage: Correctly handle string/byte types
* rpc: avoid possible recursion in create_connection
* rpc: preparations for recursion fix
* Avoid possible endless recursion in RPC call
* kdc.key should not be visible to all
* Change ConfigParser to RawConfigParser
* ca/cert-show: check certificate_out in options
* Remove pkinit-anonymous command
* Make a doctext more clear
* Provide useful messages during cert validation
* cert-show: writable files does not mean dirs
* fix managed-entries printing IPA not installed
* Fix wrong message on Dogtag instances stop
* Make CA/KRA fail when they don't start
* Remove the cachedproperty class
* Refresh Dogtag RestClient.ca_host property
* compat plugin: Update link to slapi-nis project
* compat: ignore cn=topology,cn=ipa,cn=etc subtree
* Move the compat plugin setup at the end of install
* compat-manage: behave the same for all users
* Fix CAInstance.import_ra_cert for empty passwords
* Fix RA cert import during DL0 replication
* ext. CA: correctly write the cert chain
* server-install: No double Kerberos install
* Fix CA-less to CA-full upgrade
* replicainstall: better client install exception handling
* Add the force-join option to replica install
* server-install: remove broken no-pkinit check
* Add pki_pin only when needed
* Remove publish_ca_cert() method from NSSDatabase
* Get correct CA cert nickname in CA-less
* Remove redundant option check for cert files
* replica-prepare man: remove pkinit option refs
* Don't allow setting pkinit-related options on DL0
* Fix the order of cert-files check
* Generate PIN for PKI to help Dogtag in FIPS
* Backup CA cert from kerberos folder
* Allow renaming of the sudorule objects
* Allow renaming of the HBAC rule objects
* Reworked the renaming mechanism
* Bump samba version for FIPS and priv. separation
* Backup ipa-specific httpd unit-file
* Add debug log in case cookie retrieval went wrong
=== Thierry Bordaz (1) ===
* NULL LDAP context in call to ldap_search_ext_s during search
=== Tibor Dudlák (11) ===
* otptoken_yubikey.py: Removed traceback when package missing.
* topology.py: Removes error message from dictionary.
* Add test: test_xmlrpc/test_whoami_plugin.py
* whoami.py: Type error when running tests
* Create indexes for 'serverhostname' attribute
* Add --force-join into ipa-replica-install manpage
* dnsserver.py: dnsserver-find no longer returns internal server error
* Add Role 'Enrollment Administrator'
* server.py: Removes dns-server configuration from ldap
* sssd.py: Deprecating no-sssd option.
* client.py: Replace hardcoded 'admin' with options.principal
=== Tibor Dudlák (2) ===
* user.py: replace user_mod with ldap.update_entry()
* Add 'TIP' to enable copr repo.
=== Timo Aaltonen (2) ===
* ipa-otpd.socket.in: Use a platform specific value for KDC service file
* configure: Use ODS_USER and NAMED_GROUP in daemons/dnssec/*.service.in
=== Tomas Krizek (25) ===
* Become IPA 4.6.0
* Contributors.txt: update
* zanata: update translations for ipa-4-6
* zanata: set project version to ipa-4-6
* dnssec: keep dnssec daemons in Python2
* ipatests: collect log after ipa-ca-install
* dnssec: fix localhsm.py utility script
* prci: add caless tests
* makerpms.sh: make git checkout optional
* build: checkout *.po files at the end of makerpms.sh
* freeipa-pr-ci: enable pull-request CI
* ipactl: log check_version exception
* logging: make sure logging level is set to proper value
* ipatests: do not finalize api when IPA is not configured
* ipatests: do not collect systemd journal when logfile_dir is missing
* ipatests: add systemd journal collection for multihost tests
* ipatests: change logdir naming pattern for multihost tests
* named.conf template: add modification warning
* ca, kra install: validate DM password
* installutils: add DM password validator
* ca install: merge duplicated code for DM password
* upgrade: add missing suffix to http instance
* installer service: fix typo in service entry
* python2-ipalib: add missing python dependency
* kra install: update installation failure message
=== Thorsten Scherf (2) ===
* Changed ownership of ldiffile to DS_USER
* Fixed typo in ipa-client-install output
URL: https://github.com/freeipa/freeipa/pull/1032
Author: tomaskrizek
Title: #1032: Backport PR 1002 to ipa-4-5
Action: opened
PR body:
"""
This PR was opened automatically because PR #1002 was pushed to master and backport to ipa-4-5 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1032/head:pr1032
git checkout pr1032
URL: https://github.com/freeipa/freeipa/pull/1014
Author: tomaskrizek
Title: #1014: dnssec: keep dnssec daemons in Python2
Action: opened
PR body:
"""
Until DNSSEC is ready for Python3, we should run DNSSEC with Python 2.
Signed-off-by: Tomas Krizek <tkrizek(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1014/head:pr1014
git checkout pr1014
URL: https://github.com/freeipa/freeipa/pull/1002
Author: frasertweedale
Title: #1002: Fix external renewal for CA with non-default subject DN
Action: opened
PR body:
"""
When running ``ipa-cacert-manage renew --external-ca`` with an IPA
CA having a subject DN that does not correspond to ``CN=Certificate
Authority, {subject-base}``, the CSR for submission to the external
CA does not generated. dogtag-ipa-ca-renew-agent-submit is wrongly
assuming the default form of the CA subject DN.
Update dogtag-ipa-ca-renew-agent-submit to look up the actual
subject DN.
Fixes: https://pagure.io/freeipa/issue/7123
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1002/head:pr1002
git checkout pr1002
URL: https://github.com/freeipa/freeipa/pull/908
Author: pvomacka
Title: #908: WebUI: Actions array in search facet spec does not have 'undefined' value anymore
Action: opened
PR body:
"""
In case that there are no actions specified in spec object, the concatenation
of arrays causes that 'undefined' item is added into the array.
https://pagure.io/freeipa/issue/7052
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/908/head:pr908
git checkout pr908
URL: https://github.com/freeipa/freeipa/pull/1031
Author: tomaskrizek
Title: #1031: Backport PR 884 to ipa-4-5
Action: opened
PR body:
"""
This PR was opened automatically because PR #884 was pushed to master and backport to ipa-4-5 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1031/head:pr1031
git checkout pr1031
URL: https://github.com/freeipa/freeipa/pull/1030
Author: stlaz
Title: #1030: Python3 - depend on python3-* packages by default in Fedora
Action: opened
PR body:
"""
This patchset is an easier way for a more proper solution in https://github.com/freeipa/freeipa/pull/1024. We should investigate the proper solution more to see why it fails but there's currently not enough time before release.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1030/head:pr1030
git checkout pr1030
URL: https://github.com/freeipa/freeipa/pull/884
Author: npmccallum
Title: #884: ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
Action: opened
PR body:
"""
For some unknown reason, when I wrote the ipa-otptoken-import script
I used bad input data which had the PBKDF2 parameters in the wrong
XML namespace. I have corrected this input data to match RFC 6030.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/884/head:pr884
git checkout pr884